FIrst, RSS is using the web side router, not the api side router:

Next, three auth methods are added in web side:

But the basic auth only fire on API, Download or on Git or LFSPaths, which is usually known as the usage of API access token, so it will not work for RSS route

So the only way you can do is using the session auth, which is using cookie I think.
Maybe we can move it to the api side.

IMO handling RSS more like an API request makes sense, since browsers/web clients generally don't support RSS these days, and it's a lot easier to get feed readers to make something like an API request than it is to get them to make something like a login flow. Some clients support manually setting cookie values, but most don't, and you'd have to reset them every time they expired anyway.

Or we can move this rss endpoint to the allowlist of authentication with token?